Skip to main content

Publishing Packages

Publishing deploys your compiled Move package as an immutable object on a Sui network. After publishing, you receive a package ID that other modules and transactions use to call your functions.

How do I publish a Move package?​

To publish a package, run sui client publish from the package root directory (the directory that contains Move.toml):

$ cd <PACKAGE_ROOT>
$ sui client publish

The command compiles your package, submits a publish transaction, and returns the package ID, the UpgradeCap object ID, and any objects created during the init function. The UpgradeCap is the capability that controls future upgrades of the package.

Dry-run before publishing​

Use --dry-run to simulate the publish transaction without committing it to the network. This helps you estimate gas costs and catch errors before spending gas:

$ sui client publish --dry-run

The dry-run output shows the gas budget required, the objects that would be created, and any errors in your package.

How do I estimate gas before publishing?​

The gas cost of publishing depends on the size of your compiled bytecode. Use --dry-run to see the exact gas budget required. Large packages with many modules or dependencies cost more.

How do I verify the bytecode of a published package?​

After publishing, verify that the onchain bytecode matches your local source:

$ sui client verify-source

This command rebuilds your package with the toolchain that originally published it and compares the resulting bytecode against the onchain version. Run this from your package directory.

How do I publish to a different network?​

Your active environment determines which network receives the publish transaction. Switch environments before publishing:

$ sui client switch --env testnet
$ sui client publish

Use separate environments for Testnet and Mainnet to avoid publishing to the wrong network. See Sui CLI client for environment management.

caution

Publishing is irreversible. Once you publish a package, you cannot remove it from the network. Store your UpgradeCap in a multisig address or apply a custom upgrade policy for production packages. Burn the UpgradeCap only when you are certain the package needs no future updates (Security Best Practices).

How do I publish a package with a multisig?​

For production deployments that use multisig custody, serialize the unsigned publish transaction instead of executing it directly:

$ sui client publish --serialize-unsigned-transaction

The multisig publish workflow runs in this order:

  1. Serialize the unsigned publish transaction with sui client publish --serialize-unsigned-transaction. It outputs base64-encoded transaction bytes.
  2. Distribute the transaction bytes to your multisig signers.
  3. Collect enough signatures from the signers.
  4. Submit the signed transaction with sui client execute-signed-tx.